PT-2024-5621 · Unknown · Web-Auth/Webauthn-Lib

Marcriemer · Published 2024-07-15 · Updated 2024-07-16 · CVE-2024-39912

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions web-auth/webauthn-lib versions prior to 4.9.0

Description The issue is related to the ProfileBasedRequestOptionsBuilder method in the web-auth/webauthn-lib library, which returns allowedCredentials without any credentials if no username was found. This allows an attacker to enumerate usernames based on the absence of the allowedCredentials property in the assertion options response. By knowing which usernames are valid, attackers can focus their efforts on a smaller set of potential targets, increasing the efficiency and likelihood of successful attacks.

Recommendations For versions prior to 4.9.0, upgrade to version 4.9.0 to address the issue. As a temporary workaround, consider modifying the ProfileBasedRequestOptionsBuilder method to return random credentials when no username is found, as proposed in the provided code snippet. Restrict access to the vulnerable method to minimize the risk of exploitation. Avoid using the allowedCredentials property in the assertion options response until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

BDU:2024-06319

CVE-2024-39912

GHSA-875X-G8P7-5W27

Affected Products

Web-Auth/Webauthn-Lib

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39912.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39912 · Security Note
• https://bdu.fstec.ru/vul/2024-06319 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39912 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-875x-g8p7-5w27 · Vendor Advisory
• https://github.com/web-auth/webauthn-framework · Note
• https://github.com/web-auth/webauthn-framework/commit/a9d1352897fba552e659e1445a771dec2d4ed05a · Note
• https://github.com/web-auth/webauthn-framework/commit/64de11f6cddc71e56c76e0cc4573bf94d02be045 · Note
• https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-875x-g8p7-5w27 · Note
• https://github.com/web-auth/webauthn-lib/commit/b6798de27cdedd8681fe4c9b13ace0ff2456d18b · Note
• https://t.me/cvedetector/907 · Telegram Post
• https://vuldb.com/ru/?id.271537 · Note
• https://t.me/cvenotify/86275 · Telegram Post